Over 300 Tor exit nodes hijacked in SSH and email interception campaign

Between October 2 and October 5, 2026, attackers hijacked 333 Tor exit nodes to intercept SSH traffic and retrieve plaintext email messages, according to a report by a Tor volunteer published on October 22.

The attackers initially gained access to a Tor management server using a reused password, then installed the Ebury backdoor—a Linux malware first identified 12 years ago—on that server. From there, they used an unexplained RSA key to connect via SSH to a second server, Switzerland2, and installed Ebury there as well.

The attackers reconfigured two exit nodes hosted on Switzerland2, ultimately compromising 333 relays. They redirected SSH traffic traversing Tor to one of 12 attacker-controlled interceptor servers, tricking users into entering their SSH passwords if they ignored host-key warnings. Separately, the attackers blocked ports used for encrypted email (25, 465, 587, 993, and 995) while allowing unencrypted email ports, enabling them to capture plaintext messages if services downgraded connections.

It remains unclear how the attackers gained control of the additional servers or who was responsible. The use of Ebury and the collection of unencrypted data suggest a financially motivated crime group, but this is speculative, the report notes.

The volunteer investigator created a script to poll Tor’s roughly 3,000 exit nodes and identify those that accepted an incorrect SSH fingerprint, and set up a honeypot to observe the attackers’ attempts to log in and install Ebury. The campaign highlights the need for in-depth defense strategies, such as enforcing encrypted email protocols and disabling password authentication in favor of SSH keys.